From 0e41e3c7cfa369fd261dca2caf9ad7083da86b69 Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@php.net>
Date: Wed, 13 Dec 2000 17:27:13 +0000
Subject: [PATCH] - Bodytag is insertet by fnInsAnchors() - several small bugs
 which might cause a segm fault

---
 ext/hyperwave/hg_comm.c | 43 +++++++++++++++++++++--------------------
 ext/hyperwave/hw.c      | 16 ++++++++++++---
 2 files changed, 35 insertions(+), 24 deletions(-)

diff --git a/ext/hyperwave/hg_comm.c b/ext/hyperwave/hg_comm.c
index 7662c85b08..b65bd8f34b 100644
--- a/ext/hyperwave/hg_comm.c
+++ b/ext/hyperwave/hg_comm.c
@@ -465,16 +465,16 @@ DLIST *fnCreateAnchorList(hw_objectID objID, char **anchors, char **docofanchorr
 					}
 		
 					if(!cur_ptr->destdocname) {
-					cur_ptr->link = NULL;
-					if(NULL != (str = strstr(object, "Hint=URL:"))) {
-						str += 9;
-						if(sscanf(str, "%s\n", link))
-							cur_ptr->link = estrdup(link);
-					} else if(NULL != (str = strstr(object, "Hint="))) {
-						str += 5;
-						if(sscanf(str, "%s\n", link))
-							cur_ptr->link = estrdup(link);
-					}
+						cur_ptr->link = NULL;
+						if(NULL != (str = strstr(object, "Hint=URL:"))) {
+							str += 9;
+							if(sscanf(str, "%s\n", link))
+								cur_ptr->link = estrdup(link);
+						} else if(NULL != (str = strstr(object, "Hint="))) {
+							str += 5;
+							if(sscanf(str, "%s\n", link))
+								cur_ptr->link = estrdup(link);
+						}
 					}
 		
 					cur_ptr->fragment = NULL;
@@ -687,7 +687,7 @@ char *fnInsAnchorsIntoText(char *text, DLIST *pAnchorList, char **bodytag, char
 				/* The link is only set if the Link points to an external document */
 				switch(cur_ptr->linktype) {
 					case HW_BACKGROUND_LINK:
-						snprintf(bgstr, BUFFERLEN, " background='%s'", cur_ptr->link);
+						snprintf(istr, BUFFERLEN, " background='%s'", cur_ptr->link);
 						break;
 					case HW_INTAG_LINK:
 						snprintf(istr, BUFFERLEN, " %s='%s'", cur_ptr->tagattr, cur_ptr->link);
@@ -715,10 +715,10 @@ char *fnInsAnchorsIntoText(char *text, DLIST *pAnchorList, char **bodytag, char
 			} else {
 				switch(cur_ptr->linktype) {
 					case HW_BACKGROUND_LINK:
-						if(NULL != cur_ptr->destdocname)
-							snprintf(bgstr, BUFFERLEN, " background='%s/%s'", scriptname[HW_BACKGROUND_LINK], cur_ptr->destdocname);
-						else
-							bgstr[0] = '\0';
+						if(NULL != cur_ptr->destdocname) {
+							snprintf(istr, BUFFERLEN, " background='%s/%s'", scriptname[HW_BACKGROUND_LINK], cur_ptr->destdocname);
+						} else
+							istr[0] = '\0';
 						break;
 					case HW_INTAG_LINK:
 						if(cur_ptr->fragment)
@@ -2140,7 +2140,7 @@ int send_gettext(int sockfd, hw_objectID objectID, int mode, int rootid, char **
 
 			if(pAnchorList != NULL) {
 				char *newtext;
-				char *body;
+				char *body = NULL;
 				char **prefixarray;
 
 				prefixarray = emalloc(5*sizeof(char *));
@@ -2157,7 +2157,7 @@ int send_gettext(int sockfd, hw_objectID objectID, int mode, int rootid, char **
 				dlst_kill(pAnchorList, fnDeleteAnchor);
 #endif
 				*bodytag = strdup(body);
-				efree(body);
+				if(body) efree(body);
 				*text = newtext;
 				*count = strlen(newtext);
 			}
@@ -2186,7 +2186,7 @@ send_insertanchors(char **text, int *count, char **anchors, char **destrec, int
 
 	if(pAnchorList != NULL) {
 		char *newtext;
-		char *body;
+		char *body = NULL;
 
 		newtext = fnInsAnchorsIntoText(*text, pAnchorList, &body, urlprefix);
 
@@ -2197,7 +2197,8 @@ send_insertanchors(char **text, int *count, char **anchors, char **destrec, int
 		dlst_kill(pAnchorList, fnDeleteAnchor);
 #endif
 		*bodytag = strdup(body);
-		efree(body);
+		if(body) efree(body);
+fprintf(stderr, "bodytag = %s\n", *bodytag);
 		*text = newtext;
 		*count = strlen(newtext);
 	}
@@ -5094,7 +5095,7 @@ int send_pipedocument(int sockfd, char *host, hw_objectID objectID, int mode, in
 
 			if(pAnchorList != NULL) {
 				char *newtext;
-				char *body;
+				char *body = NULL;
 
 				newtext = fnInsAnchorsIntoText(*text, pAnchorList, &body, urlprefix);
 #ifdef newlist
@@ -5104,7 +5105,7 @@ int send_pipedocument(int sockfd, char *host, hw_objectID objectID, int mode, in
 				dlst_kill(pAnchorList, fnDeleteAnchor);
 #endif
 				*bodytag = strdup(body);
-				efree(body);
+				if(body) efree(body);
 				*text = newtext;
 				*count = strlen(newtext);
 			}
diff --git a/ext/hyperwave/hw.c b/ext/hyperwave/hw.c
index 6fdad299d2..c5871c41f2 100644
--- a/ext/hyperwave/hw.c
+++ b/ext/hyperwave/hw.c
@@ -655,10 +655,12 @@ static char **make_strs_from_array(HashTable *arrht) {
 		switch(data->type) {
 			case IS_STRING:
 				*ptr = estrdup(data->value.str.val);
-fprintf(stderr, "carr[] = %s\n", *ptr);
-				ptr++;
+/*fprintf(stderr, "carr[] = %s\n", *ptr); */
 				break;
+			default:
+				*ptr = NULL;
 		}
+		ptr++;
 
 		zend_hash_move_forward(arrht);
 	}
@@ -2819,7 +2821,12 @@ PHP_FUNCTION(hw_document_bodytag) {
 		strcpy(temp+strlen(ptr->bodytag)-1+argv[1]->value.str.len, ">\n");
 		RETURN_STRING(temp, 0);
 	} else {
-		RETURN_STRING(ptr->bodytag, 1);
+//fprintf(stderr, "hw_document_bodytag: %s (%s)\n", ptr->bodytag, ptr->attributes);
+		if(ptr->bodytag) {
+			RETURN_STRING(ptr->bodytag, 1);
+		} else {
+			RETURN_EMPTY_STRING();
+		}
 	}
 }
 /* }}} */
@@ -4186,7 +4193,10 @@ PHP_FUNCTION(hw_insertanchors) {
 		php_error(E_WARNING, "command (insertanchors) returned %d\n", error);
 		RETURN_FALSE;
 	}
+/*fprintf(stderr, "in hw_insertanchors: %s\n", hwdoc->attributes); */
 	hwdoc->size = count;
+	if(hwdoc->bodytag) free (hwdoc->bodytag);
+	hwdoc->bodytag = bodytag;
 
 	RETURN_TRUE;
 }
-- 
2.40.0